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I. Basis of the report 

1 . With regard to the elements of the international application (Replacement sheets which have been furnished to 
the receiving Office in response to an invitation under Article 14 are referred to in this report as "originally filed'' 
and are not annexed to this report since they do not contain amendments (Rules 70. 16 and 70. 1 7)): 
Description, pages: 

1-10 as received on 22/02/2001 with letter of 1 9/02/2001 

Claims, No.: 

1-10 as received on 22/02/2001 with letter of 1 9/02/2001 

Drawings, sheets: 

1/2,2/2 as received on 22/02/2001 with letter of 19/02/2001 



2. With regard to the language, all the elements marked above were available or furnished to this Authority in the 
language in which the international application was filed, unless otherwise indicated under this item. 

These elements were available or furnished to this Authority in the following language: , which is: 

□ the language of a translation furnished for the purposes of the international search (under Rule 23.1 (b)). 

□ the language of publication of the international application (under Rule 48.3(b)). 

□ the language of a translation furnished for the purposes of international preliminary examination (under Rule 
55.2 and/or 55.3). 

3. With regard to any nucleotide and/or amino acid sequence disclosed in the international application, the 
international preliminary examination was carried out on the basis of the sequence listing: 

□ contained in the international application in written form. 

□ filed together with the intemational application in computer readable form. 

□ furnished subsequently to this Authority in written form. 

□ furnished subsequently to this Authority in computer readable form. 

□ The statement that the subsequently furnished written sequence listing does not go beyond the disclosure in 
the intemational application as filed has been furnished. 

□ The statement that the information recorded in computer readable form is identical to the written sequence 
listing has been fumished. 

4. The amendments have resulted in the cancellation of: 

□ the description, pages: 

□ the claims, Nos.: 
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□ the drawings, sheets: 

5. □ This report has been established as if (some of) the amendments had not been made, since they have been 
considered to go beyond the disclosure as filed (Rule 70.2(c)): 

(Any replacement sheet containing such amendments must be referred to under item 1 and annexed to this 
report.) 



6. Additional observations, if necessary: 



V. Reasoned statement under Article 35(2) with regard to novelty, Inventive step or industrial applicability; 
citations and explanations supporting such statement 

1. Statement 

Novelty (N) Yes: Claims 1-10 

No: Claims 

Inventive step (IS) Yes: Claims 1-10 

No: Claims 

Industrial applicability (lA) Yes: Claims 1-10 

No: Claims 



2. Citations and explanations 
see separate sheet 
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Reference is made to the following documents: 

D1: GB-A-2317792 

D2: US-A-5699513 

D3: US-A-5826029 

D4: EP-A2-0858201 

The following document was not cited in the international search report. 

D5: WO-A2-9700471 

Re Item V 

Reasoned statement under Article 35(2) with regard to novelty, inventive step or 
industrial applicability; citations and explanations supporting such statement 

The present application relates to a data communication method for sending a 
message on a computer network from a first computer system to at least one 
other computer system through a firewall. 

The first computer system belongs to an internal network and is protected by a 
firewall. 

Messages that are sent from the internal network to at least one other computer 
system go through this firewall. 

First a request with data for a new connection to be opened will be sent from the 
first computer system to at least other computer system for a message to be sent 
between the computer systems. Upon approval of the connection by the firewall, 
the firewall sends information back to the first computer system about the 
necessary modifications to be made (IP protocol, TCP port data), so that the 
message can pass through the firewall to the other network. 

The prior art as represented by the documents cited above discloses several 
network scenarios with different firewall architectures. 

The closest prior art appears to be D5, which describes a method for a message 
flow into and out of a network, which is protected by a firewall, in accordance with 
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the rules of a rule base. 

The method in D2 differs however from the claimed method in that all 
modifications are made by the firewall itself (encryption of messages, etc.). 

The idea of the application is that a part of the firewall functionality has been given 
to another computer function and is carried out in the first computer system. If the 
message is protected, the firewall and the first computer system transfers 
necessary information so that the firewall would be able to pass the protected 
messages. The application provides a safer method for sending protected 
messages through a firewall, because the protected messages can be sent 
through a firewall without delivering information about the parameters outside the 
local network to the firewall. 

Additionally the method of the application decreases the work to be done by the 
firewall computer compared with previously known methods. 

However, all firewalls of the prior art (D1-D5) need extensive equipment if the 
traffic amount through the firewall is high, because all the messages are identified 
and protected by the firewall itself. The drawback with such methods is decreased 
security for the local network as secret information is delivered outside the local 
network. 

The subject-matter of the independent method claim 1 cannot be derived by 
combining D5 with any other document. 

Therefore, the method of this application is neither disclosed nor derivable from 
the prior art as represented by the documents cited above. 
An inventive step is therefore acknowledged. 

The requirements of Article 33(3) PCT are therefore met for claims 1 to 1 0. 
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DATA COMMUNICATION METHOD FOR SENDING A MESSAGE THROUGH ^ 
^REWALL 

5 TECHNICAL FIELD 

The invention is concerned \A/ith a data communication method for sending a 
message on a computer network from a first computer system to at least one other 
computer system through a firewall. The method can be used for sending protected 
10 messages with various kinds of protection methods, computer networks and 
network protocols and is expected to be very useful for instance for sending secret 
messages. 

15 DESCRIPTION OF RELATED ART 

A computer network is formed when two or more computers are connected to each 
other. Local area networks (or internal networks) may be formed of the computers 
within a company, while wide area networks may be extended over bigger areas, 
20 such as many towns and even countries. The networks may be connected via 
cables, fibers and/or radio links. 

An example of a global network is the Internet. This worldwide network can be used 
for communication, delivering and searching for information. 



If an internal system for electronic post is installed, everyone connected to the local 
network can send messages to each other. The local network can be connected to 
another network, which can be an external network, such as Internet, and so 
electronic mail can be sent to the whole world to everyone connected to the 
30 external network. Internet is the most common network for data communication, by 
for example E-mail. 



25 
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The fact that several local networks can be connected to other networks, Internet in 
particular, sets up requirements for the security and the equipment therefor 

There are different systems for the improving of the security. It is important that 
data within an internal network is protected so that only right users can' change and 
read it. The users usually identify themselves with a user name and a password. 
Also other security details exist. Other security problems are network errors and 
work stops. With increasing complexity, advanced security systems become 
important. 

The popularity of Internet can be seen on the fact that new network products and 
services are developed all the time. These products are developed in accordance 
with new Internet standards and are applied to the protocols used in transfers on 
Internet. 

A firewall is a security system to protect a network against infringement from 
unauthorized users in other networks, such as Internet. A firewall can hinder 
computers from communicating directly with other networks, such as external 
networks, and vice versa. Instead, all communication is sent through the firewall 
placed outside the internal network. The firewall decides if it is safe to let messages 
and files pass between the external and the internal network on the basis of the 
addresses of the message, that can be in form of data packets, and different 
parameters. The firewall thus controls the communication between the internal and 
external network and modifies the data packets of for example TCP/IP based 
Internet (with respect to the TCP/IP protocol, see the next page). Usually, a firewall 
translates network addresses and other data defining the communication so that 
the internal address and the internal parameters are changed to an external 
address and external parameters. This means that for instance IP addresses used 
in an internal or local network are hidden from outside users. A packet coming from 
an external network to an internal network is modified back by the firewall. 
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The firewall can be formed in many different ways and is usually designed 
individually from case to case in accordance with the actual needs of the network. If 
the amount of traffic through the firewall is very high, quite extensive hardware for 
the firewall computer is needed. 

5 

Another method of increasing the security is by means of protection of the 
messages to be sent by for instance tunneling in virtual networks. In virtual 
networks several local and global networks use Internet to be connected to each 
other. By tunneling, data is transferred between two networks via a third network, 

10 such as Internet. In this technique, a given kind of data packets of a given protocol 
is encapsulated in packets of another protocol. Packet mode is a transfer method 
that can be used in virtual connections. In this technique data is sent in small 
"packets" with an address and a sender, so that several persons can use the 
connection simultaneously. The other protocol is usually TCP/IP, when the 

15 transfers go through Internet. The own protocols are packed in the TCP/IP 
packages that are sent via Internet. 



The data communication between computers is carried out according to given rules 
which are called. protocols TCP/IP is one such protocol and is an abbreviation for 

20 Transmission Control Protocol/Internet Protocol. Standards for TCP/IP are well 
documented in so called RFC (Request for comments) documents. The IP protocol 
takes care of the data packets and is responsible for that the packets find right 
addresses. The data packets are addressed by means of internet addresses and 
go from computer to computer until the right destination is reached. Communication 

25 with IP is connectionless as no fixed connection exist between communicating 
computers. The message is going forward step by step. The TCP protocol takes 
care of the transferring of messages between two computers by making a virtual 
connection between them without any physical connection. The TCP is the 
transport protocol that is responsible for the connection itself between sender and 

30 receiver Also other standards than TCP/IP can be used in Internet. 
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The packets go through the "tunnel" maintained by Internet to the receiver, v/here 
the packets of different protocols are separated from each other and return to the 
original form. The authorization of the receiver can be controlled in different ways. 
The authorization control can be carried out in two steps: authentication and 
5 authorization. Authentication is carried out to control the identity of the user, \A4iile 
the authorization defines what the user is authorized to do. 

The virtual networks give a high security. The secret information has an own 
channel on Internet as a result of different methods of authentication, encryption 
10 and/or encapsulation. 

The security of Internet is not sufficient for all types of transfers. There are however 
ways to protect e-mail and other messages sent through internet from others. 
Especially high security can be achieved by encryption. 

15 

Encryption means that messages are changed before sending so that they cannot 
be read before decryption with a special key and usually also by confirming that the 
right person sent the message (authentication). There are a big variety of 
encryption methods of the above kind. 

20 

In many protection methods all connections have different parameters. The function 
wherein the real protection is made is called transformation. In the transformation 
function the packet is changed in accordance with given parameters depending on 
the actual protection used. 

25 

One problem with firewalls is the need of extensive equipment for the firewall 
computer if the traffic amount of traffic through the firewall is high. 

Another problem with firewalls is that if protection methods are used and the 
30 network is protected with a firewall, the firewall cannot identify the messages to be 
sent and will therefore not let them pass. 
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In existing methods, the protection function or the parameters for the protection are 
given to the firewall so that the firewall can identify or protect the message and the 
message can then be sent through the firewall. The drawback with such methods is 
decreased security for the local network as secret information is delivered outside 
the local network. 

US patent 0715668 is mentioned as such prior art. The patent is about secure 
transfer of information between firewalls over an unprotected network. Internet 
protocol security and IPSec messages are handled in the firewall without assuming 
that encrypted messages has access to all services by decrypting the message and 
controlling the access. 

Another such method is described in US patent 0586231, wherein a firewall 
computer is allowed to provide virtual tunnel records and secret keys. 

In the European patent application EP 0 858 201 an electronic data transfer system 
transmits a message between the first computer system, arranged within a firewall, 
and a second computer system. Messages that are not suitable for transmission 
through a firewall are translated in a format that is appropriate for transmission 
across the firewall. 



THE OBJECT OF THE INVENTION 

An object of the invention is a method of sending messages that decreases the 
work to be done by the firewall computer compared with previously known methods. 

The second object of the invention is a safer method of sending protected 
messages through a firewall. 




wo 00/48372 PCT/FI 00/00075 

6 

More in detail, the second object of the invention is a method wherein protected 
messages can be sent through a firewall without delivering information about the 
parameters of the protection outside the local network to the firewall. 

5 

DESCRIPTION OF THE INVENTION 

In the method of the invention a message is sent on a computer network from a 
first computer system to at least one other computer system through a firewall. In 

10 step a), a request with data for a new connection between the first computer 
system and at least one other computer system is sent from the first computer 
system to the firewall. In step b), up on approval of the message, information about 
the necessary modifications to be made in a message that is sent via the requested 
connection through the firewall is sent from the firewall to the first computer system. 

15 In step c), the protected message to be sent is modified in the first computer 
system in accordance with the information sent from the firewall. In step d), which is 
optional and can be carried out before step c) or after step c), identification data of 
the connection for the message to be sent between said computer systems is sent 
to the firewall so that the message can be identified by the firewall to be able to 

20 pass the same. In step e), the protected message is then sent from the first 
computer system to the at least one other computer system through the firewall. 

In an application of the method, the message to be sent is protected as the method 
is very suitable for sending protected messages. The message to be sent between 
25 said computer systems is in that case protected in step c) after it has been 
modified, whereby step d) is necessary and the data to be sent from the first 
computer system to the firewall includes the necessary information so that the 
connection for the message can be identified by the firewall. 

30 The protection method can be some method known in the art. One suitable way to 
protect the message is to use methods defined in the standard RFC 1825 for 
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TCP/IP. This standard includes sub standards for for instance authentication 
methods and encryption methods, which can be used separately or simultaneously 
in a message sent with the method of the invention. RFC 1825 is a standard 
defining the IPSec security system standard, which consists of technology 
5 principles for the method used. IPSec. in turn, has sub standards for encryption, 
such as ESP, which is an abbreviation for encapsulated security protocol and AH, 
which is an abbreviation for a standard in IP for authentication. The authentication 
method might be MD5, SHA or other method known in the art. The encryption 
method might be some known method such as DES, Blowfish or the like. 



In step a), the request for a new communication sent from the first computer system 
to the firewall contains for instance data of the new connection to be opened 
between the first computer system and at least one other computer system in for 
example in form of address identification data and such other parameters. Typical 
15 other parameters are for instance IP Data ( the sender address, the receiver 
address), the type of protocol and TCP data: the sender port and the receiver port. 
The port defines the application for sending the data with e.g. TCP/IP, such as the 
program used, the web browser etc. 

20 In step b), typical parameters that the firewall modifies so that the messages can 
pass through are the above data, for instance IP Data ( the sender address, the 
receiver address), the type of protocol and TCP data: the sender port and the 
receiver port. The modifications might comprise all data of step a) or a part of them. 
All of the data to be modified might be known by the firewall even if not exactly 

25 included in step a). 

Messages can only go through a firewall if the firewall can identify them to be 
allowable messages. In step d), identification data for the protection used to protect 
the message to be sent between said computer systems is sent to the firewall so 
30 that the protected message can be identified by the firewall. The identification data 
is in such a form that the firewall can identify the actual connection but not the 



10 
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actual parameters that have been used to protect the message. There exist many 
allowed connections \Mth the same IP address but different other parameters. The 
actual protected message is sent in accordance with the parameters of one of the 
allowed connections and shall be identified by the firewall as being allowed and 
5 safe to deliver. If the message is not protected, step d) might be unnecessary in 
some embodiments, but is still advantageous to carry out in other embodiments, for 
instance if much traffic is going through the firewall, step d) might speed up the 
sending. 

10 In the invention, the inventive idea is that a part of the firewall functionality has 
been given to another computer function and is carried out in the first computer 
system. If the message is protected, the firewall and the first computer system 
transfers necessary information so that the firewall would be able to pass the 
protected messages without having knowledge about the actual parameters used to 

15 protect the message to be sent. 

In the following, the invention is described by means of some preferred 
embodiments of the invention. The details of the embodiments can vary within the 
scope of the claims. 



BRIEF DESCRIPTION OF DRAWINGS 

Figure 1 is a flow sheet over the different steps of the method of invention 

25 

Figure 2 is a schematic view of the computer network within which the data 
communication of the invention is carried out 



20 
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DETAILED DESCRIPTION OF THE INVENTION 

Figure 2 is a schematic view of a computer network within which the data 
communication of the invention can be carried out. A message shall be sent from a 
first computer system C1 to a second computer system C2. 

In figure 2, the first computer system belongs to an internal network. The internal 
network is protected by a firewall, so that all messages to be sent and received 
through the firewall has to be identified and accepted by the firewall. 
The firewall controls data of the connection via which the messages are sent and if 
the connection is accepted by the firewall, the messages can pass the firewall. 
Before the messages can pass the firewall, they are modified in the firewall in 
accordance with given parameters, such as address changes and protocol 
changes. The computer system CI has a virtual connection to computer system 
C2, which means that messages to be sent from the first computer system C1 to 
the second computer system C2 are sent via one or more other networks, such as 
external networks, for instance Internet, after having passed the firewall before 
ending up at and received by the second computer system C2. 

Figure 1 is a flow sheet over the different steps of an embodiment of the method of 
the invention. A message shall be sent on a computer network from the first 
computer system C1 to a second computer system C2 through a firewall, which is 
placed outside the internal or local network to which the first computer system C1 
belongs. The method of the invention can be used both for the purpose to decrease 
the work to be carried out by the firewall and/or for sending protected messages. If 
the message to be sent shall be protected before sending in accordance with the 
second embodiment of the invention, it can not be sent through the firewall in the 
normal way, because the firewall is not able to control address identification data of 
protected messages or foPA^ard encrypted messages. Therefor, in accordance with 
step a) of the invention, an information message is sent from the first computer 
system CI to the firewall containing data about a new connection between the first 
computer system C1 and a second computer system C2 system in form of for 
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instance address identification data, and possible other parameters for the 
message to be sent between said computer systems. If the firewall accepts this 
connection, the sending proceeds so that according to step b), information about 
necessary changes to be made in the message is sent from the firewall to the first 
5 computer system C1 so that the message can be sent through the firewall. The 
message that is intended to be protected with some protection method, that can be 
an authentication method and/or encryption method and shall be sent is according 
to step c) first modified by the first computer system CI in accordance with the 
information sent from the firewall before protection. Before the protected message 

10 is sent, identification data of the protection method that have been used for 
protection of the message is according to point d) sent from the first computer 
system CI to the firewall F so that the protected message can be identified but not 
read by the firewall to be able to be passed by the same. If the message is not 
protected, step d) is optional if the firewall used is able to identify the message. 

15 Step d) can also be carried out before step c). The protected message is then 
according to step e) sent from the first computer system CI to the other computer 
system C2 through the firewall. 



20 
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CLAIMS 

1. Method for sending a message on a computer network from a first computer 
system to at least one other computer system through a firewall, character! 
2 e d in the following steps: 

a) sending from the first computer system to the firewall, a request with data for a 
new connection between the first computer system and at least one other 
computer system for a message to be sent between said computer systems, 

b) up on approval of the connection by the firewall, sending from the firewall to the 
first computer system, information about the necessary modifications to be 
made in a message that is sent via the requested connection through the 
firewall, 

c) modifying, in the first computer system, the message to be sent in accordance 
with the information sent from the firewall, 

d) optionally, and before or after step c), sending from the first computer system to 
the firewall identification data of the connection for the message to be sent 
between said computer systems so that the connection for the message can be 
identified by the firewall and the message can pass the firewall, 

e) sending the message from the first computer system to the at least one other 
computer system through the firewall. 

2. Method of claim 1, characterized in that, the message to be sent 
between said computer systems is protected in step c) after it has been modified, 
whereby step d) is necessary and the data to be sent from the first computer 
system to the firewall includes the necessary information so that the connection for 
the message can be identified by the firewall. 

3. Method of claim 2, characterized in that the protection is made using 
the IP Sec system. 
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4. Method of claim 2 or 3, characterized in that the message to be sent is 
authenticated. 



5. Method of any of claims 2-4, characterized in that the message to be 
5 sent is encrypted in step c). 

6. Method of any of claims 1-5, characterized in that the information 
message in point a) contains data of the new connection to be opened between 
the first computer system and at least one other computer system in form of 

10 address identification data and possible other parameters. 

7. Method of claim 6, characterized in that the possible other parameters 
are data about the port and the protocol used for sending. 

15 8. Method of any of claims 1-7, characterized in that in step b) the 
modifications include address identification data and/or the port and or the 
protocol used for sending. 

9. Method of any of claim 1-7, characterized in that, the message is 
20 using the TCP/IP protocol. 



10. Method of any of claim 1-8, characterized in that, the message is sent 
via internet. 



25 



30 



wo 00/48372 



* 



• 09/913213 

PCT/FIOO/00075 

1/2 



Step a) 
Cl ► Firewall 






Yes 

r 


Step b) 


Firewall 


— ► Cl 



I 



Step c) 






Cl 








r 


Step d) 






CL ►Firewall 






r 


Step e) 
Cl , 


^ Firewall 


Firewall 


— ► C2 



FIG. 1 



LN TERNA TIONAL SEARCH REPORT 



A. CLASSIF ICATION OF SUBJtCf MA Ti nR 



International application No. 

PCT/FI 00/00075 



IPC7: H04L 29/06, G06F 17/60 

According to Iniernalional Patenl Cliissification (IPC) or lo both national classincalion and IPC 



B. FIELDS SEARCHED 



Minimum documentation searched (elassification system followed by classification symbols) 

IPC7: H04L, G06F 



Documenlalion searched other than minimum documeniation lo the extent that such documents arc included in the fields searched 

SE,DK,FI,NO classes as above 



Electronic data base consulted during the international search (name of data base and, where practicable, search terms used) 



C. DOCUMENIS CONSIDERED TO BE RELEVANT 



Category 



Citation of document, with indication. wJiere appropriate, of the relevant passages 



GB 2317792 A (SECURE COMPUTING CORPORATION), 

1 April 1998 (01.04.98), page 4, line 8 - line 18; 

page 7, line 23 - line 25, claim 8, 

abstract 



US 5699513 A (FEIGEN ET AL) , 16 December 1997 
(16.12.97), figure 3, claim 1, abstract 



US 5826029 A (GORE ET AL), 20 October 1998 

(20.10.98), column 1, line 46 - column 2, line 26, 
claim 1, abstract 



Relevant to claim No. 



1-10 



1-10 



1-10 



XJ Further documents are listed in the continuation of Box C. | y\ See patent family annex. 



* Special calcgoncs of cilcd documents: 

"A" document defining the gcncraJ stale of the art which in not con'ndercd 

lo be of particular relevance 
"E" crher document but published on or after the international filing date 
"L" document which may throw doubts on priority claim(s) or which is 

cited to establish the publication date of another citation or other 

special reason (as specified) 

"O" document referring to an oral disclosure, use, exhibition or other 
means 

"P" document published prior to the international filing dale but later than 
the priority dale claimed 



"X* 



later document published after the inicrnationaJ filing dale or priority 
date and not m conflict with the application but cited to understand 
the principle or theory underlying the invention 

document of particular relevance: the claimed invention cannot be 
considered novel or cannot be considered lo involve an inventive 
step when the document is taken alone 

document of particular relevance: the claimed invention cannot be 
considered to involve an inventive step when the document is 
combined wi\h one or more other such documents, such combination 
being obvious lo a person skilled in the art 

document member of the same patent family 



Date of tlie actual completion of the international search 

23 Mav 2000 


Date of mailing of the international search report 

0 6 -06- 2000 


Name and mailing address of the ISA/ 
Swedish Patent Office 
Box 5055. S-102 42 STOCKHOLM 
Facsimile No. + 46 8 666 02 86 
Form PCT./ISA.aiO (second sheets fJuIv IQOO\ 


Authorized oflicer 

Jan Silfverling/mj 

Telephone No. -1-46 8 782 25 00 



LN TERN A TIONAL SEARCH REPORT 



Inlernationai application No. 

PCT/FI 00/00075 



C (Coriuuuatiori). DOCUMENTS CONSIDERED TO BE RELEVANT 



Category * 



Citation of docunient, with iridicalion, wiicrc appropriate, of the relevant passages 



Relevant to claim No. 



EP 0858201 A2 (SUN MICROSYSTEMS INC.), 
12 August 1998 (12.08.98), claim 1, 
abstract 



1-10 



Form PCT/lSA/210 (continuaUon of second sheet) (July 1992) 



LNTERNATIONAL SEARCH REPORT 

Information on patent family nienibers 



02/12/99 



Intertiational application No. 

PCT/FI 00/00075 



Patent ducument 
cited in search report 


PublicAlion 
date 


Patent family 
member(s) 


Publication 
date 


GB 2317792 A 


01/04/98 


DE 


19741239 


A 


07/05/98 






DE 


19741246 


A 


19/03/98 






GB 


2317539 


A 


25/03/98 






GB 


9719816 


D 


00/00/00 






GB 


9719818 


D 


00/00/00 






US 


5983350 


A 


09/11/99 






US 


5950195 


A 


07/09/99 



US 5699513 A 16/12/97 NONE 



US 5826029 A 



20/10/98 



CA 


2233441 


A 


09/05/97 


CN 


1201573 


A 


09/12/98 


CZ 


9801141 


A 


14/10/98 


EP 


0872097 


A 


21/10/98 


HU 


9802414 


A 


01/02/99 


JP 


10512696 


T 


02/12/98 


PL 


327446 


A 


07/12/98 


WO 


9716911 


A 


09/05/97 



EP 0858201 A2 12/08/98 NONE 



Form PCr/lSA.aiO (patent family annex) (July 1992) 



